WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing

🗓️ 27 Sep 2026 02:09:04Reported by ProjectDiscoveryType

WordPress FastDup plugin prior to 2.2 exposes sensitive export files via directory listing without authentication.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2023-6592	6 Feb 202409:11	–	circl
CNNVD	WordPress plugin FastDup security vulnerability	16 Jan 202400:00	–	cnnvd
CVE	CVE-2023-6592	16 Jan 202415:57	–	cve
Cvelist	CVE-2023-6592 FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure	16 Jan 202415:57	–	cvelist
NVD	CVE-2023-6592	16 Jan 202416:15	–	nvd
OSV	CVE-2023-6592	16 Jan 202416:15	–	osv
Patchstack	WordPress FastDup Plugin <= 2.1.9 is vulnerable to Sensitive Data Exposure	16 Jan 202400:00	–	patchstack
Prion	Design/Logic Flaw	16 Jan 202416:15	–	prion
Positive Technologies	PT-2024-15017	16 Jan 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-6592: Undefined Security Weakness	16 Jan 202400:00	–	rapid7

Source	Link
wpscan	www.wpscan.com/vulnerability/a39bb807-b143-4863-88ff-1783e407d7d4/
wordpress	www.wordpress.org/plugins/fastdup/
plugins	www.plugins.trac.wordpress.org/changeset/3012664
wordfence	www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fastdup/fastdup-219-sensitive-information-exposure-via-directory-listing

id: CVE-2023-6592

info:
  name: WordPress FastDup <= 2.1.9  Sensitive Information Exposure - Directory Listing
  author: pussycat0x
  severity: medium
  description: |
    FastDup WordPress plugin < 2.2 contains a directory listing vulnerability caused by lack of access restrictions in sensitive directories, letting attackers view export files, exploit requires no authentication.
  impact: |
    Attackers can access sensitive export files, potentially leading to information disclosure.
  remediation: |
    Update to version 2.2 or later.
  reference:
    - https://wpscan.com/vulnerability/a39bb807-b143-4863-88ff-1783e407d7d4/
    - https://wordpress.org/plugins/fastdup/
    - https://plugins.trac.wordpress.org/changeset/3012664
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/fastdup/fastdup-219-sensitive-information-exposure-via-directory-listing
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2023-6592
    cwe-id: CWE-548
    epss-score: 0.00905
    epss-percentile: 0.58231
  metadata:
    verified: true
    max-request: 3
    shodan-query: http.component:"WordPress"
    fofa-query: body="wp-content/njt-fastdup"
    google-query: inurl:"/wp-content/njt-fastdup/packages/" intitle:"Index of"
  tags: cve,cve2023,wordpress,wp-plugin,fastdup,log,wp

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/fastdup/logs/"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Index of"
          - "Parent Directory"
        condition: or

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        name: listed-files
        regex:
          - 'href="([^"]+\.(zip|sql|log|txt|json|gz|tar))"'
# digest: 4a0a004730450220069894c1fdf273149ad3a297f24048675ca6392effbf43c8926840bb06b5351a022100e8200cb1798a44dd795839d73feb657460d7f01c55397ea6b0a66fa3a9c28d0d:922c64590222798bb761d5b6d8e72950

09 Apr 2026 05:01Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3

EPSS0.00905

SSVC